AS42207 - AKOSPARFC 4890 ✓RPKI ✓ 3/3ASPA -

AS overview

Test target: 2a0b:15c0:abcd:1::abcd:ac05 · (external source) · address space: PA · prefixes announced: 3

prefix(es): 2a0b:15c4::/30, 2a0b:15c0::/29, 2a0b:15c0::/30

SIX peering

Random-IP probe (yarrp) into the AS' prefixes

We probed 30 arbitrary IPv6 address(es) inside AS42207's announced prefix(es). No router inside the prefix responded. The deepest visible hop was 2001:470:0:578::2 at hop 9 - that router answers ICMPv6 Echo. This is not in AS42207's announced prefix; operationally it's the AS-edge / peering interface (often on a SIX peering address or an upstream's /127 link). The traceroute boundary is the AS edge: ICMPv6 Time-Exceeded responses from anything inside this AS are filtered.

ICMPv6 Type 2 (Packet Too Big) acceptance - active test

Vantage points disagree about Type 2 acceptance - transit ASes on one path may be filtering Type 2 even though the destination's stack accepts it on another path:

• NL host (go6lab): Type 2 honored. Forged PTB accepted; next response shrunk. (ICMPv6 Echo + forged PTB)
• ITA host (Karsolink): Type 2 NOT honored. Forged PTB had no effect (filtered en route or stack ignored it). (ICMPv6 Echo + forged PTB)
• SLO host (6connect): Type 2 honored. Forged PTB accepted; next response shrunk. (ICMPv6 Echo + forged PTB)

Why they disagree - path-asymmetric Type 2 filtering: Both vantages used the ICMPv6 Echo + forged-PTB method on the same destination IP, but reached different verdicts. The destination's stack is the same in both cases - so the difference is in the path: a transit AS on one route filters our forged Type 2 (or its return ICMPv6 carrying the embedded packet) while the other route delivers it intact. The vantage that says honored shows what the destination's stack actually does; the one that says not honored shows that the path between us and them drops Type 2.

sudo tcpdump -i any -n -e 'icmp6 and ip6[40] = 2 and (src host 2607:fae0:a000::42 or src host 2a00:8642:42::75 or src host 2a12:d8c0:105a:9001::a154)'

sudo ip6tables -L INPUT -nv | grep -iE 'icmpv6|packet-too-big'
sudo nft list ruleset 2>/dev/null | grep -A1 'icmpv6'

sudo sysctl net.ipv6.conf.all.accept_redirects net.ipv4.ip_no_pmtu_disc net.ipv6.route.mtu_expires

sudo tcpdump -i any -n -e 'icmp6 and ip6[40] = 2 and (src host 2607:fae0:a000::42 or src host 2a00:8642:42::75 or src host 2a12:d8c0:105a:9001::a154)'

From NL host (go6lab)   openRFC 4890 ✓

filter likely at: (none) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

tracepath -6

 1?: [LOCALHOST]                        0.036ms pmtu 1500
 1:  2a00:8642:42::3                                       1.674ms 
 1:  2a00:8642:42::3                                       1.959ms 
 2:  gw.friends.steffann.nl                                3.239ms 
 3:  no reply
 4:  be1.core3.ams1.he.net                                 7.194ms 
 5:  be2.core4.fra1.he.net                                10.454ms 
 6:  be3.core2.fra2.he.net                                11.305ms 
 7:  100ge0-0-0-3.core1.vie1.he.net                       23.686ms 
 8:  100ge0-0-0-23.core1.vie1.he.net                      23.214ms asymm  7 
 9:  six.akos.si                                          26.706ms 
10:  no reply
11:  no reply
12:  no reply
13:  no reply
14:  no reply
15:  no reply
16:  no reply
17:  no reply
18:  no reply
19:  no reply
20:  no reply
21:  no reply
22:  no reply
23:  no reply
24:  no reply
     Too many hops: pmtu 1500
     Resume: pmtu 1500 

From ITA host (Karsolink)   openRFC 4890 ✗

filter likely at: (none) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

Rate-limited ICMPv6: hop 3 (loss between 5% and 95% across mtr cycles - the router replies but only sometimes).

tracepath -6

 1?: [LOCALHOST]                        0.029ms pmtu 1500
 1:  no reply
 2:  2a12:d8c0:109f:121::a1                                0.760ms 
 3:  2a12:d8c0:101f:6::1                                  10.490ms 
 4:  no reply
 5:  e0-35.core1.zag2.he.net                              19.258ms 
 6:  no reply
 7:  e0-35.core1.lju1.he.net                              22.514ms 
 8:  six.akos.si                                          23.189ms 
 9:  no reply
10:  no reply
11:  no reply
12:  no reply
13:  no reply
14:  no reply
15:  no reply
16:  no reply
17:  no reply
18:  no reply
19:  no reply
20:  no reply
21:  no reply
22:  no reply
23:  no reply
24:  no reply
     Too many hops: pmtu 1500
     Resume: pmtu 1500 

From SLO host (6connect)   openRFC 4890 ✓

filter likely at: (none) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

Rate-limited ICMPv6: hop 3 (loss between 5% and 95% across mtr cycles - the router replies but only sometimes).

tracepath -6

 1?: [LOCALHOST]                        0.033ms pmtu 1500
 1:  fw1-lju.6connect.com                                  0.700ms 
 1:  fw1-lju.6connect.com                                  0.898ms 
 2:  ccr-to-fw-ccr1-gw-lju.6connect.com                    0.763ms 
 3:  2a03:a100:0:201:1::1                                  0.670ms 
 4:  six.akos.si                                           3.483ms 
 5:  no reply
 6:  no reply
 7:  no reply
 8:  no reply
 9:  no reply
10:  no reply
11:  no reply
12:  no reply
13:  no reply
14:  no reply
15:  no reply
16:  no reply
17:  no reply
18:  no reply
19:  no reply
20:  no reply
21:  no reply
22:  no reply
23:  no reply
24:  no reply
     Too many hops: pmtu 1500
     Resume: pmtu 1500